CVE-2026-11355: DT LMS WordPress Plugin Auth Bypass Flaw

CVE-2026-11355 Overview

The DT LMS – elearning WordPress plugin contains a missing authorization vulnerability [CWE-862] in multiple AJAX handlers. Affected handlers include dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings. These handlers are registered on the wp_ajax_nopriv_* hook and lack both capability checks and nonce verification. Unauthenticated attackers can send crafted AJAX requests to overwrite arbitrary plugin option values stored in the wp_options table. Affected data includes Point-of-Contact email configuration and skin/branding settings that control the appearance and behavior of the LMS for all site visitors. Versions up to and including 1.1 are vulnerable.

Critical Impact

Unauthenticated attackers can remotely modify plugin option values, redirecting contact emails and altering site branding for every visitor.

Affected Products

• DT LMS – elearning, WordPress LMS plugin (dt-lms-lite)
• All versions up to and including 1.1
• WordPress sites with the affected plugin installed and active

Discovery Timeline

• 2026-09-12 - CVE-2026-11355 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-11355

Vulnerability Analysis

The DT LMS plugin exposes several administrative settings handlers through WordPress AJAX endpoints. Registering these handlers on the wp_ajax_nopriv_* hook makes them reachable by users who are not logged in. The affected handlers include dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings. Each handler accepts POST parameters and passes them directly to update_option() without validation. This allows attackers to write attacker-controlled values into the wp_options table for any plugin option name the handlers accept.

Root Cause

The underlying weakness is Missing Authorization [CWE-862]. The handlers perform no capability check using functions such as current_user_can(), and they omit nonce verification via check_ajax_referer() or wp_verify_nonce(). Combined with registration on the unauthenticated AJAX hook, any HTTP client can reach the handlers and successfully modify plugin options. The plugin developers assumed the handlers would only be invoked from the administrative interface, but WordPress does not enforce that assumption at the transport layer.

Attack Vector

An attacker sends an HTTP POST request to /wp-admin/admin-ajax.php with the action parameter set to one of the vulnerable handler names. The request body contains the option data to write. The vulnerability does not permit direct code execution or database record disclosure. However, an attacker can alter Point-of-Contact email addresses to intercept LMS communications, or replace skin and branding assets to deface the site or stage social engineering attacks against learners.

No public exploit code is available at time of publication. Technical details are documented in the Wordfence Vulnerability Analysis and the WordPress DT LMS Lite Settings Utility source.

Detection Methods for CVE-2026-11355

Indicators of Compromise

• Unexpected POST requests to /wp-admin/admin-ajax.php with action values of dtlms_save_poc_settings, dtlms_save_skin_settings, or dtlms_save_options_settings from unauthenticated sessions.
• Changes to plugin-controlled rows in the wp_options table, including modified Point-of-Contact email addresses or altered skin and branding option values.
• Visitor-facing LMS pages rendering unexpected branding, colors, logos, or contact details.

Detection Strategies

• Enable WordPress access logging and alert on admin-ajax.php traffic where the action parameter matches the affected dtlms_* handler names and no authenticated session cookie is present.
• Baseline the contents of plugin-owned rows in wp_options and generate alerts on unauthorized modification.
• Deploy a Web Application Firewall (WAF) rule that blocks POST requests to the vulnerable AJAX actions when no valid nonce is supplied.

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized analytics platform for correlation across admin-ajax.php requests and option-table changes.
• Monitor outbound email flow from the LMS for unexpected sender or reply-to addresses that could indicate PoC email tampering.
• Track plugin file integrity and installed version to confirm patched builds remain in place after deployment.

How to Mitigate CVE-2026-11355

Immediate Actions Required

• Update the DT LMS – elearning plugin to a version later than 1.1 that removes the wp_ajax_nopriv_* registrations and adds capability and nonce checks.
• If no patched version is available, deactivate and remove the plugin until a fix is published.
• Audit wp_options values controlled by the plugin, particularly the Point-of-Contact email and skin/branding settings, and restore known-good values.

Patch Information

Refer to the WordPress DT LMS Lite Changeset Update for the vendor's remediation commit. Review the WordPress DT LMS Lite PoC Utility source to confirm the handlers have been rewritten with proper authorization and nonce validation.

Workarounds

• Block requests to /wp-admin/admin-ajax.php where the action parameter equals dtlms_save_poc_settings, dtlms_save_skin_settings, or dtlms_save_options_settings at the WAF or reverse proxy layer.
• Restrict access to /wp-admin/ from untrusted networks using IP allow-listing where operationally feasible.
• Disable the plugin on sites that do not actively use its LMS functionality until an upgrade path is validated.

# Example NGINX rule to block the vulnerable AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^dtlms_save_(poc|skin|options)_settings$") {
        return 403;
    }
    if ($request_method = POST) {
        if ($request_body ~* "action=dtlms_save_(poc|skin|options)_settings") {
            return 403;
        }
    }
}